Networking

First PublishedFeb 17, 2026Last UpdatedMar 30, 2026ByAtif Alam

Every Azure resource that communicates over a network lives inside a VNet (Virtual Network). VNets are conceptually identical to AWS VPCs — your isolated network in the cloud.

VNet (Virtual Network)

1
┌───────────────────────────────────────────────────────┐
2
│  VNet: myapp-vnet  10.0.0.0/16                        │
3
│                                                        │
4
│  ┌────────────────────┐  ┌────────────────────┐       │
5
│  │  Public Subnet      │  │  Public Subnet      │       │
6
│  │  10.0.1.0/24        │  │  10.0.2.0/24        │       │
7
│  │  (AZ 1)             │  │  (AZ 2)             │       │
8
│  │  ┌──────┐ ┌──────┐  │  │  ┌──────┐          │       │
9
│  │  │ App GW│ │ NAT  │  │  │  │ App GW│          │       │
10
│  │  └──────┘ └──────┘  │  │  └──────┘          │       │
11
│  └────────────────────┘  └────────────────────┘       │
12
│                                                        │
13
│  ┌────────────────────┐  ┌────────────────────┐       │
14
│  │  Private Subnet     │  │  Private Subnet     │       │
15
│  │  10.0.3.0/24        │  │  10.0.4.0/24        │       │
16
│  │  (AZ 1)             │  │  (AZ 2)             │       │
17
│  │  ┌──────┐ ┌──────┐  │  │  ┌──────┐ ┌──────┐ │       │
18
│  │  │  VM  │ │  DB  │  │  │  │  VM  │ │  DB  │ │       │
19
│  │  └──────┘ └──────┘  │  │  └──────┘ └──────┘ │       │
20
│  └────────────────────┘  └────────────────────┘       │
21
└───────────────────────────────────────────────────────┘

Creating a VNet

1
# Create a VNet with two subnets
2
az network vnet create \
3
  --resource-group myapp-rg \
4
  --name myapp-vnet \
5
  --address-prefix 10.0.0.0/16 \
6
  --subnet-name frontend \
7
  --subnet-prefix 10.0.1.0/24
8

9
az network vnet subnet create \
10
  --resource-group myapp-rg \
11
  --vnet-name myapp-vnet \
12
  --name backend \
13
  --address-prefix 10.0.3.0/24

Azure vs AWS Networking Concepts

Azure	AWS	Purpose
VNet	VPC	Isolated virtual network
Subnet	Subnet	IP range within the network
NSG	Security Group + NACL	Firewall rules (see stateful vs stateless below)
Azure Load Balancer	NLB	Layer 4 load balancing
Application Gateway	ALB	Layer 7 load balancing (HTTP)
Azure DNS	Route 53	DNS management
VNet Peering	VPC Peering	Connect two VNets
NAT Gateway	NAT Gateway	Outbound internet for private subnets
Azure Firewall	AWS Network Firewall	Managed firewall service
Private Endpoint	VPC Endpoint	Private access to Azure services

NSGs (Network Security Groups)

NSGs filter network traffic to and from Azure resources. They combine the functionality of AWS security groups and NACLs.

NSGs and Stateful vs Stateless Traffic

NSG rules are stateful for TCP and UDP in the usual sense: when you allow an inbound flow, Azure can associate return traffic so you do not need a separate rule for every ephemeral client port on the return path (similar to AWS security groups). You still think in terms of inbound vs outbound rules and priority (first match wins), which feels closer to NACL-style ordering than to “merge all SG rules.” For the cross-cloud vocabulary, see Stateful vs Stateless Firewalls on the AWS networking page and the TCP/IP primer. For TLS certificates in Azure, see Azure security (Key Vault) and TLS and Certificates for the AWS side of a hybrid mental model.

How NSGs Work

NSG rules have a priority (100–4096, lower = higher priority). Rules are evaluated in priority order — first match wins.

1
Inbound traffic ──► NSG rules (by priority) ──► Allow or Deny

Default Rules

Every NSG comes with default rules you can’t delete:

Priority	Direction	Action	Description
65000	Inbound	Allow	VNet to VNet traffic
65001	Inbound	Allow	Azure Load Balancer health probes
65500	Inbound	Deny	Deny all other inbound
65000	Outbound	Allow	VNet to VNet traffic
65001	Outbound	Allow	Internet outbound
65500	Outbound	Deny	Deny all other outbound

Creating NSG Rules

1
# Create an NSG
2
az network nsg create --resource-group myapp-rg --name web-nsg
3

4
# Allow HTTP from anywhere
5
az network nsg rule create \
6
  --resource-group myapp-rg \
7
  --nsg-name web-nsg \
8
  --name AllowHTTP \
9
  --priority 100 \
10
  --direction Inbound \
11
  --access Allow \
12
  --protocol Tcp \
13
  --destination-port-ranges 80 443 \
14
  --source-address-prefixes '*'
15

16
# Allow SSH from a specific IP
17
az network nsg rule create \
18
  --resource-group myapp-rg \
19
  --nsg-name web-nsg \
20
  --name AllowSSH \
21
  --priority 110 \
22
  --direction Inbound \
23
  --access Allow \
24
  --protocol Tcp \
25
  --destination-port-ranges 22 \
26
  --source-address-prefixes 203.0.113.50/32
27

28
# Associate NSG with a subnet
29
az network vnet subnet update \
30
  --resource-group myapp-rg \
31
  --vnet-name myapp-vnet \
32
  --name frontend \
33
  --network-security-group web-nsg

Application Security Groups (ASGs)

ASGs let you group VMs logically and reference them in NSG rules (like AWS SG-to-SG references):

1
# Create ASGs
2
az network asg create --resource-group myapp-rg --name web-servers
3
az network asg create --resource-group myapp-rg --name db-servers
4

5
# Allow web-servers to access db-servers on port 5432
6
az network nsg rule create \
7
  --resource-group myapp-rg \
8
  --nsg-name backend-nsg \
9
  --name AllowWebToDb \
10
  --priority 100 \
11
  --direction Inbound \
12
  --access Allow \
13
  --protocol Tcp \
14
  --destination-port-ranges 5432 \
15
  --source-asgs web-servers \
16
  --destination-asgs db-servers

Load Balancers

Azure Load Balancer (Layer 4)

Distributes TCP/UDP traffic. Comparable to AWS NLB.

SKU	Features	Use Case
Basic	Limited, no AZ support, free	Dev/test
Standard	AZ-aware, zone-redundant, SLA, required for production	Production

1
# Create a standard load balancer
2
az network lb create \
3
  --resource-group myapp-rg \
4
  --name my-lb \
5
  --sku Standard \
6
  --frontend-ip-name myFrontend \
7
  --backend-pool-name myBackend \
8
  --public-ip-address my-public-ip

Application Gateway (Layer 7)

HTTP/HTTPS load balancer with URL-based routing, SSL termination, and WAF. Comparable to AWS ALB.

1
Client ──► Application Gateway ──► /api/*    ──► Backend Pool A (VMs)
2
                                ──► /web/*    ──► Backend Pool B (App Service)
3
                                ──► /static/* ──► Backend Pool C (Storage)

Key features:

URL-based routing — Route by path or hostname.
SSL termination — Offload TLS at the gateway.
Web Application Firewall (WAF) — Built-in OWASP protection.
Autoscaling — Scale based on traffic.
Session affinity — Sticky sessions via cookies.

Azure Front Door

Global load balancer and CDN — comparable to AWS CloudFront + Global Accelerator:

Global HTTP/HTTPS routing with latency-based or priority-based routing.
Built-in WAF and DDoS protection.
SSL offloading at the edge.
Caching at edge locations worldwide.

Use Front Door for globally distributed applications; Application Gateway for regional applications.

Azure DNS

Managed DNS service for hosting DNS zones:

1
# Create a DNS zone
2
az network dns zone create --resource-group myapp-rg --name example.com
3

4
# Add an A record
5
az network dns record-set a add-record \
6
  --resource-group myapp-rg \
7
  --zone-name example.com \
8
  --record-set-name www \
9
  --ipv4-address 20.50.100.150
10

11
# Add a CNAME
12
az network dns record-set cname set-record \
13
  --resource-group myapp-rg \
14
  --zone-name example.com \
15
  --record-set-name api \
16
  --cname api.azurewebsites.net

Azure Private DNS resolves names within a VNet (like AWS Route 53 private hosted zones).

VNet Peering

Connect two VNets so resources can communicate directly using private IPs:

1
# Peer VNet-A to VNet-B
2
az network vnet peering create \
3
  --resource-group rg-a \
4
  --name a-to-b \
5
  --vnet-name vnet-a \
6
  --remote-vnet /subscriptions/.../resourceGroups/rg-b/providers/Microsoft.Network/virtualNetworks/vnet-b \
7
  --allow-vnet-access
8

9
# Peer VNet-B to VNet-A (peering must be created in both directions)
10
az network vnet peering create \
11
  --resource-group rg-b \
12
  --name b-to-a \
13
  --vnet-name vnet-b \
14
  --remote-vnet /subscriptions/.../resourceGroups/rg-a/providers/Microsoft.Network/virtualNetworks/vnet-a \
15
  --allow-vnet-access

Works across regions (global VNet peering) and across subscriptions.
Not transitive — A↔B and B↔C doesn’t give A↔C (use Azure Virtual WAN or hub-spoke with a firewall for that).

Private Endpoints

Access Azure PaaS services (Storage, SQL, Key Vault) over a private IP in your VNet — traffic never goes over the internet:

1
az network private-endpoint create \
2
  --resource-group myapp-rg \
3
  --name my-sql-pe \
4
  --vnet-name myapp-vnet \
5
  --subnet backend \
6
  --private-connection-resource-id /subscriptions/.../Microsoft.Sql/servers/my-sql-server \
7
  --group-ids sqlServer \
8
  --connection-name my-sql-connection

The Azure SQL server now has a private IP (10.0.3.x) in your VNet. Disable public access on the SQL server to ensure all traffic goes through the private endpoint.

NAT Gateway

Provides outbound internet for private subnets (like AWS NAT Gateway):

1
# Create a NAT gateway
2
az network nat gateway create \
3
  --resource-group myapp-rg \
4
  --name my-nat-gw \
5
  --public-ip-addresses my-nat-ip
6

7
# Associate with a subnet
8
az network vnet subnet update \
9
  --resource-group myapp-rg \
10
  --vnet-name myapp-vnet \
11
  --name backend \
12
  --nat-gateway my-nat-gw

Key Takeaways

A VNet is your isolated network. Plan CIDR ranges to avoid conflicts with other VNets and on-premises networks.
NSGs are firewall rules evaluated by priority (first match wins). Use ASGs for logical grouping.
Application Gateway for Layer 7 (HTTP routing, SSL, WAF); Azure Load Balancer for Layer 4 (TCP/UDP).
Azure Front Door for global applications with built-in CDN, WAF, and latency-based routing.
Use Private Endpoints to access PaaS services (SQL, Storage, Key Vault) over private IPs — no internet exposure.
VNet Peering connects two VNets directly. Not transitive — use hub-spoke topology with a firewall for complex networks.